Security and Data Handling
Last reviewed: 26 October 2026
In short
- All traffic to the site and the verification API is encrypted with HTTPS.
- Uploaded lists leave our systems after 7 days, and cached results after 14 days. On paid plans, only a list’s risky addresses stay up to 14 days after it finishes, so you can re-check them.
- We never see your card number, and we never store a password because you sign in with Google.
- We do not sell your data and we do not use your lists for marketing.
- 9 service providers process data for us. They are listed on the subprocessors page.
Encryption
- In transit: the website is served over HTTPS with HSTS. The verification API at api.simpleverifier.com is served over HTTPS, and the website reaches it only over HTTPS with a secret key that every request must carry.
- Stored credentials: API keys are stored only as SHA-256 hashes. Instantly and Smartlead keys that you connect are encrypted with AES-256-GCM before they are stored and are not written to logs.
- Card data: entered directly into Stripe’s embedded checkout and never reaches our servers.
- At rest: see “What we have not done” below. We make no encryption-at-rest claim for our own server.
What we store and for how long
Verification sends each address to the mail server that owns it and asks whether it would accept mail. No email is sent. Here is what stays behind.
| Data | What it contains | How long |
|---|---|---|
| Result files and job records | The file name, row counts, statuses and the downloadable results CSV for each list | Deleted 7 days after the list is submitted. Download your results within that time. A list that is still running or waiting for the next daily allowance is kept until it finishes. On paid plans, the job record (not the results file) of a list with risky rows stays until its re-check window closes, 14 days after the list finishes. |
| Risky rows kept for a re-check | Only addresses marked Send with care or Check again later, with their earlier status and reason. Never safe or invalid addresses, never your other columns | Free accounts: deleted with the results file, 7 days after the list is submitted. Paid plans: deleted 14 days after the list finishes. |
| Cached mailbox results | The address and its result (status and reason), not linked to your account | Used for 14 days so a repeat check is instant, then deleted by an hourly cleanup. |
| Account record | Email, name, plan, subscription status, sign-in count | Kept while your account exists. Deleted on request. |
| API keys | A SHA-256 hash, a short hint, created and last-used times | Kept until you revoke the key; the key itself is never stored. |
| Usage records | Per-account counts of checks, API calls and lookups per month, and a log of list sizes | Kept while your account exists. They hold counts and job references, not the addresses you checked. |
| Payment records | Held by Stripe, not by us | As long as tax and accounting law requires. |
The cleanups run automatically on the server as lists are submitted, not on a separate timer, so on a quiet day an expired file can sit a little past its date before the next run removes it. The privacy policy has the full retention list, including analytics providers.
Deleting your data
Email [email protected] from the address on your account and ask us to delete your account, your lists or both. We reply within 30 days. Deleting an account removes the account record, the job records and the results files. Payment records stay with Stripe for as long as the law requires.
Who can access data
- People: only the small team that runs SimpleVerifier has administrative access. Nobody reads customer lists unless you ask for help with a specific list, it is needed to investigate abuse or a security problem, or the law requires it.
- The verification server: shell access is by SSH key only, with password sign-in switched off. The database listens on the server itself and is not reachable from the internet. Only the web ports (80 and 443) and SSH are open to the internet.
- The admin dashboard: restricted to a short list of team email addresses, checked against the Google sign-in.
- Customers: you see only your own lists. Team seats and client workspaces on Business and Agency plans share a workspace owner’s lists with the members the owner adds.
- The free trial: to allow one trial per person we keep a salted, one-way hash of the IP address and the card fingerprint, never the raw values.
Hosting
- Website and functions: Vercel.
- Verification server: one virtual server at Contabo, running the SMTP checks, list jobs and the database that holds results and usage. Its address is in Contabo’s US network.
- Account database: Supabase.
- Payments: Stripe. Analytics: PostHog, Google Analytics and Vercel Web Analytics, as described in the privacy policy.
The full list with the data each provider receives is on the subprocessors page.
What we have not done
Saying this plainly is the point of the page.
- We hold no SOC 2, ISO 27001, HIPAA or similar certification or audit report, and we are not GDPR or privacy-framework certified. We say what we do on this page instead.
- We do not run an automated backup schedule with a fixed retention. We take manual database snapshots before maintenance changes, and those are not on a deletion schedule yet.
- We have not set up encryption of the verification server's disk, so we make no claim about encryption at rest on that server. Stripe, Supabase and Vercel run their own platforms under their own terms.
- Application logs on the verification server have no fixed expiry configured yet. A sample of recent logs held no email addresses, but we do not promise that no error line ever contains one.
- There is no self-service delete button for your account or lists yet. Deleting an account is done by hand when you email us.
- We have not commissioned an independent penetration test.
Agreements and incidents
- Data processing agreement: a DPA template is on the DPA page, with a downloadable copy.
- Incident contact: email [email protected].
- Breach notice: if a security incident affects personal data we hold for you, we will tell affected account holders without undue delay once we have confirmed it, and in any case as the law requires.
- Report a vulnerability: see responsible disclosure and our security.txt.
Questions
Does SimpleVerifier have SOC 2 or ISO 27001?
No. SimpleVerifier holds no SOC 2, ISO 27001 or similar certification. The security page lists what we actually do and what we do not.
How long does SimpleVerifier keep uploaded lists?
Result files and job records are deleted 7 days after a list is submitted. On paid plans, a list's risky addresses and its job record (no results file) are kept for 14 days after it finishes so they can be re-checked. Cached mailbox results are used for 14 days and then deleted. Account records are kept until you ask us to delete them.
Is there a data processing agreement (DPA)?
Yes. A DPA template is published on the DPA page and can be downloaded as Markdown. It is a template for review, not legal advice, and is countersigned on request by email.
Who are SimpleVerifier's subprocessors?
Contabo (verification server), Vercel (website), Supabase (account database), Stripe (payments), Google (sign-in, analytics, lead search listings), PostHog (analytics), Telnyx (phone lookups), ImprovMX (email forwarding) and Resend (account and lifecycle email, being introduced). The subprocessors page has the detail.